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ICO call for views on a direct marketing code 
of practice 


The Information Commissioner is calling for views on a direct 
marketing code of practice. 


The Data Protection Act 2018 requires the Commissioner to produce 
a code of practice that provides practical guidance and promotes 
good practice in regard to direct marketing. 


While direct marketing is an important and useful tool to help 
organisations engage with people in order to grow their business or 
to publicise and gain support for their causes, it can also be 
intrusive and have a negative impact on people if done badly. This 
can cause reputational damage to organisations and, in some cases, 
result in fines or other regulatory action for breaking data protection 
laws. 


So it is important that organisations ensure their marketing 
activities are compliant with data protection legislation (the General 
Data Protection Regulation and Data Protection Act 2018) and, 
where necessary, the Privacy and Electronic Communications 
Regulations 2003 (PECR). 


We have previously published detailed direct marketing guidance. 
The new code will build on that guidance and address the aspects of 
the new legislation relevant to direct marketing such as 
transparency and lawful bases for processing, as well as covering 
the rules on electronic marketing (for example emails, text 
messages, phone calls) under PECR. 


The European Union is in the process of replacing the current e- 
privacy law (and therefore PECR) with a new ePrivacy Regulation 
(ePR). However the new ePR is yet to be agreed and there is no 
certainty about what the final rules will be. Because of this we 
intend for the direct marketing code to only cover the current PECR 
rules until the ePR is agreed. Once the ePR is finalised and the UK 
position in relation to it is clear we will produce an updated version 
of the code which takes this into account as appropriate. 
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This call for views is the first stage of the consultation process. The 
Commissioner is seeking input from relevant stakeholders, including 
trade associations, data subjects and those representing the 
interests of data subjects. We will use the responses we receive to 


inform our work in developing the code. 


You can email your response to directmarketingcode@ico.org.uk 
Or print and post to: 


Direct Marketing Code Call for Views 
Engagement Department 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the call for views, please 
email the Direct Marketing Code team. 


Please send us your views by 24 December 2018. 


Privacy statement 


For this call for views we will publish responses received from 
organisations but will remove any personal data before publication. 
We will not publish responses from individuals. For more 
information about what we do with personal data please see our 
privacy notice. 
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uestions 


Q1 The code will address the changes in data protection 
legislation and the implications for direct marketing. What 
changes to the data protection legislation do you think we 
should focus on in the direct marketing code? 


e Clarity must be provided on how research from the public 
record - i.e. the supporter's website or public info such as 
Companies’ House - can or cannot be used for segmentation or 
otherwise tailoring our offering - when we are legitimately in a 
position to communicate with someone. 

e Clarity on the use of marketing lists for email communications. 
What can be included in content for charity and not-for-profits? 
Eg. If a charity sends regular e-bulletins to contacts who have 
opted in, is it possible to highlight opportunities to donate 
under the ‘usual course of business’ contacts? 

e The distinction between personal and corporate/business leads 
and how/if they are treated differently. 

e Use of lead generation agencies. Responsibilities of the 
organisation receiving/buying the data. 

e Use of suppression lists vs the GDPR principle on the data we 
hold and why we hold it. 

e Implications of lead generation and building direct marketing 
contact lists through social media channels. 


Q2 = Apart from the recent changes to data protection legislation 
are there other developments that are having an impact on 
your organisation’s direct marketing practices that you think 
we should address in the code? 


Yes 
[| ] No 


Q3 If yes please specify 


e There is an obvious tension between the fundraising/marketing 
and data protection compliance arms of any organisation. The 
code must be written in such a way that the 
meaning/interpretation/implementation is made clear by the 
ICO and not through a translation offered by the compliance 
function within an organisation. The code must not be written 
in jargon or prose impenetrable to the uninitiated. 
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If the data protection part of an organisation has to do any 
translation/clarification for the fundraising and marketing 
function it will create conflicts and tensions that will reduce the 
outputs of organisations, create unforeseen effects and reduce 
overall compliance. 


Q4 Weare planning to produce the code before the draft ePrivacy 
Regulation (ePR) is agreed. We will then produce a revised 
code once the ePR becomes law. Do you agree with this 
approach? 


[ ] No 
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Q6 Is the content of the ICO’s existing direct marketing guidance 
relevant to the marketing that your organisation is involved 
in? 


Yes 
[ ] No 


Q7 If no what additional areas would you like to see covered? 
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Q8 Isit easy to find information in our existing direct marketing 
guidance? 


Yes 
[ ] No 


Q9 If no, do you have any suggestions on how we should 
structure the direct marketing code? 


© 

ICO. 

Q10 Please provide details of any case studies or marketing n 
scenarios that you would like to see included in the direct 


marketing code. 


More case studies covering email for charities (as opposed to 
phone and text). 


Q11 Do you have any other suggestions for the direct marketing 
code? 


About you 


Q12 Are you answering these questions as? 
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A public sector worker 

A private sector worker 

A third or voluntary sector worker 

A member of the public 

A representative of a trade association 
A data subject 

An ICO employee 

Other 


OUUU L 


If you answered ‘other’ please specify: 


İCO. 


Information Commissioner's Office 


Q13 Please provide the name of the organisation that you are 
representing. 


Ambitious about Autism 


Q14 We may want to contact you about some of the points you 
have raised. If you are happy for us to do this please provide 
your email address: 


ambitiousaboutautism.org.uk 


Thank you for taking the time to share your views and experience. 
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